CVE-2026-98767
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.17 %mayor que el 6 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
Cuando dwc3_check_event_buf() lee un valor de GEVNTCOUNT que supera la longitud del búfer de eventos, el commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") devuelve IRQ_NONE sin escribir de nuevo GEVNTCOUNT. Dado que la interrupción de DWC3 es activada por nivel, la fuente de IRQ sin limpiar mantiene la línea activa, lo que provoca una tormenta de IRQ intensa que acumula 99.900 interrupciones no gestionadas y desencadena spurious.c:184 BUG -> kernel panic.
Leer descripción completaMostrar menos
Para reproducirlo, escriba un valor no válido que supere la longitud del búfer de eventos directamente en el registro GEVNTCOUNT:
Escriba de nuevo el recuento no válido en GEVNTCOUNT para limpiar la fuente de IRQ, en coherencia con el patrón de limpieza de eventos obsoletos de dwc3_event_buffers_setup(), y programe la recuperación de errores para reinicializar el controlador.
Detalles técnicos trazas, registros y código del informe original
La pila de llamadas resultante: __report_bad_irq+0xac/0xc8 note_interrupt+0x340/0x468 handle_irq_event+0xac/0xc0 handle_fasteoi_irq+0x120/0x228 gic_handle_irq+0x68/0x108 ... kernel BUG at kernel/irq/spurious.c:184 devmem <DWC3_BASE + 0xc40c> 4 0x1004
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98767",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "52a7c9d930b95aa8b1620edaba4818040c32631f",
"lessThan": "96918ca25ff467c25675478fc79393df4ae9d74c",
"versionType": "git"
},
{
"status": "affected",
"version": "63ccd26cd1f6600421795f6ca3e625076be06c9f",
"lessThan": "ba927133b301894e7d24099afbb701887c8cd2f1",
"versionType": "git"
},
{
"status": "affected",
"version": "63ccd26cd1f6600421795f6ca3e625076be06c9f",
"lessThan": "f51cadb02b439850ab411df0a2cf4288a66d42e2",
"versionType": "git"
},
{
"status": "affected",
"version": "63ccd26cd1f6600421795f6ca3e625076be06c9f",
"lessThan": "1ff77cbefe5a653ea12874c213ea4bd0d72c1067",
"versionType": "git"
},
{
"status": "affected",
"version": "015c39f38e69a491d2abd5e98869a500a9459b3b",
"versionType": "git"
},
{
"status": "affected",
"version": "b43225948b231b3f331194010f84512bee4d9f59",
"versionType": "git"
},
{
"status": "affected",
"version": "c0079630f268843a25ed75226169cba40e0d8880",
"versionType": "git"
},
{
"status": "affected",
"version": "a44547015287a19001384fe94dbff84c92ce4ee1",
"versionType": "git"
},
{
"status": "affected",
"version": "c4d80e41cb42008dceb35e5dbf52574d93beac0d",
"versionType": "git"
},
{
"status": "affected",
"version": "99d655119b870ee60e4dbf310aa9a1ed8d9ede3d",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.26",
"lessThan": "6.12.113",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.293",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.237",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.181",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.136",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.89",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.5",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"drivers/usb/dwc3/core.h",
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/dwc3/core.h",
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:30.550",
"references": [
{
"url": "https://git.kernel.org/stable/c/1ff77cbefe5a653ea12874c213ea4bd0d72c1067",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/96918ca25ff467c25675478fc79393df4ae9d74c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ba927133b301894e7d24099afbb701887c8cd2f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f51cadb02b439850ab411df0a2cf4288a66d42e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: fix IRQ storm on invalid event buffer count\n\nWhen dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the\nevent buffer length, commit 63ccd26cd1f6 (\"usb: dwc3: gadget: check\nthat event count does not exceed event buffer length\") returns IRQ_NONE\nwithout writing back GEVNTCOUNT. Since the DWC3 interrupt is\nlevel-triggered, the uncleared IRQ source keeps the line asserted,\ncausing a tight IRQ storm that accumulates 99,900 unhandled interrupts\nand triggers spurious.c:184 BUG -> kernel panic.\n\nThe resulting call stack:\n __report_bad_irq+0xac/0xc8\n note_interrupt+0x340/0x468\n handle_irq_event+0xac/0xc0\n handle_fasteoi_irq+0x120/0x228\n gic_handle_irq+0x68/0x108\n ...\n kernel BUG at kernel/irq/spurious.c:184\n\nTo reproduce, write a bogus value exceeding the event buffer length\ndirectly to the GEVNTCOUNT register:\n\n devmem <DWC3_BASE + 0xc40c> 4 0x1004\n\nWrite the bogus count back to GEVNTCOUNT to clear the IRQ source,\nconsistent with the stale event clearing pattern in\ndwc3_event_buffers_setup(), and schedule error recovery to\nreinitialize the controller."
}
],
"lastModified": "2026-10-19T10:19:40.823",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}